I am trying to plot the CPU utilisation of all processes on a Solaris server using the following search query:
index="os" host="myhost" source="ps" | multikv fields PID pctCPU COMMAND forceheader=1 | timechart avg(pctCPU) by PID
This works, but I would like the lines in my chart to be labelled with the COMMAND field rather than PID. I can't change the "by" clause to COMMAND as more than one process has the same value for the COMMAND field.
Could someone please suggest a way of achieving this?
You could append the command to the pid and use that as your grouping field.
You could append the command to the pid and use that as your grouping field.
As suggested, this worked and gave me the result I wanted: index="os" host="myhost" source="ps" | multikv | eval pidAndCommand=PID." ".COMMAND | timechart avg(pctCPU) by pidAndCommand